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Fig. 22A 



fingerprint { 

OS ID = "Microsoft Windows 2000' 

# Sub -Module A 

icmp_echo_code = 0 
icmp_echo_ip_id = 10 
icmp_echo_tos_bits = 0 
icmp_echo_df_bit = 1 
icmp_echo_reply_ttl = < 128 

# Sub-Module B 
icmp_timestamp_replY = y 
icmp_timestamp_reply_ttl = <128 
icmp_timestarap_reply_ip_id = !0 

# Sub-Module C 
icmp_addrmask_reply = n 
icmp_addrmask_reply_ttl = <128 
icmp_addrmask_reply_ip_id = 10 

# Sub-Module D 
icmp_info_reply = n 
icmp_info_reply_ttl = <128 
icmp_inf o_reply_ip_id = ! 0 
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Fig. 22A (Cont.) 



# Sub-Module E 

# I P_H e a de r_o f __t h e_U D P_P o r t_U nreachabl e__e r r o r _me 
ssage' 

icmp_unreach_echoed_dtsize = 8 
icmp_unreach_reply_ttl = <128 
icmp__unreach_precedence_bits = 0 
icinp__unreach__df_bit = 0 
icmp_unreach_ip_id == ! 0 

#Original_data_echoed_with_the_UDP_Port__Unreach 
able_error_message 

icmp_unreach_echoed_udp_cksuin = OK 
icmp_unreach_echoed_ip_cksum = OK 
icmp_unreach_echoed_ip_id = OK 
icmp_unreach_echoed_total_len = OK 
icmp_unreach_echoed_3bit_f lags = OK 

# Sub-Module F [TCP SYN | ACK Module] 
#IP header of the TCP' SYN | ACK 
tcp_syn_ack_tos = 0 
tcp_syn_ack_df = 1 
tcp_syn_ack_ip_id = ! 0 
tcp_syn_ack_ttl = <128 

header 
17520 

= "MSS NOP WSCALE NOP 



#Inf ormation from the TCP 
tcp_syn_ack___ack = 1 
tcp__syn_ack__window_size = 
t cp_s y n_a c k_op t i ons_o r de r 
NOP TIMESTAMP NOP NOP SACK" 
tcp_syn_ack_wscale = 0 
tcp_syn_ack_tsval = 0 
tcp_syn_ack_tsecr = 0 
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Fig. 22B 

fingerprint { 

OS_ID = "Microsoft Windows 2003 Server " 

# Sub-Module A 
icinp_echo_code = 0 
icmp_echo__ip_id = ! 0 
icmp_echo_tos_bits = 0 
icmp_echo_df_bit = 1 
icmp_echo__reply_ttl = < 12 8 

# Sub-Module B 
icmp_timestamp_reply = y 
icmp_timestamp_reply_ttl = <128 
icmp_timestamp_reply_ip_id = ! 0 

# Sub-Module C 
icmp_addrmask__reply = n 
icmp_addrmask_reply_ttl = <128 
icmp_addrmask_reply_ip_id = !0 

# Sub-Module D 
icmp_inf o_reply = n 
icmp_inf o_reply_ttl = <l28 
icmp^inf o_reply_ip_id = ! 0 
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Fig- 22B (Cont.) 



4t Sub-Module E 

;irHeader_of_the_UDP_Port_anreachable_error_me 

ssage , -.^ ■ ^c/i 

icmp_unreach_echoed_dtsize - >e>4 

icmp_unreach_reply_ttl = <128^ 
icmp_unreach^recedence_bits - 0 

icmp_unreach_df_bit = 0 
icntp_unreach_ip_id = 10 

#Original_data_echoed_with_the_UDP_Port_Unreach 

able error_message 

l^cmp unreach_echoed_udp_cksum - OK 
icmpIunreach_echoed_ip_cksum - OK 
icmp unreach_echoed_ip_id = OK 
icmp'unreach_echoed_total_len - OK 
icmpIunreach_echoed_3bit_flags = OK 

# sub-Module F [TCP SYN 1 ACK Module] 
#IP header of the TCP SYN 1 ACK 
tcp_syn_ack_tos = 0 
tcp_syn_ack_df = 1 
tcp_syn_ack_ip_id = 10 
tcp_syn_ack_ttl = <128 

#Information from the TCP header 

tcp_syn_ack_ack = 1 

4-^^ cxTT^ ^n\c window size — ±/o^^ 

tcplsynltckloptioni.o-rfer = "MSS NOP WSCALE «0P 

NOP TIMESTAMP NOP NOP SACK" 
tcp_syn_ack__ws-cale = 0 
tcp_syn_ack_tsval = 0 
tcp_syn_ack__tsecr = 0 

} 



